spec(ingest): V1 — generated til O2-formen, ratifisert 2026-08-02

Utfører vedtaket fra docs/plan/2026-07-26-v1-generated-felt-okf-v0.2.md §4.1/§4.2.
Kanonisk form: `generated: { by: process:okf-ingest, at: <ingested_at> }` — USITERT,
fordi frontmatter parses line-oriented (method-spec.md:90, §3), så et anførselstegn
ville vært et tegn i verdien, ikke syntaks.

De fem kontraktslinjene, alle re-målt mot ordrett tekst før endring:

- §1 honesty rule + §3 (to steder): stempelet gjengitt ÉN vei — `generated.by`
  naming/equal to the ingest actor. Prosa, mekanisk.
- §7 feltrad: skrevet om, ikke søk-og-erstattet. Raden DEFINERER nå begge
  undernøklene (`by`, `at`) i stedet for å splittes i egne rader — samme akse som
  §4 bruker for `source` (én tabellrad + struktur i prosa).
- §11 load-bearing «Stamp integrity»: RØD-BETINGELSE i konformanskontrakten.
  Predikatet er aktør-spesifikt (`generated.by` == aktøren), ALDRI nøkkelens
  tilstedeværelse — fordi oppstrøms v0.2 skriver `generated` på håndskrevet
  innhold (`by: human:jsmith@acme`, målt i underlaget §3). Nøkkel-tilstedeværelse
  som predikat ville avvist legitimt kurert innhold.

Konsekvens: `generated: true` finnes ikke lenger i specen (verifisert).
Utløser varslingsplikten til llm-ingestion-okf — de fire DEFAULT-fasitene er
våre å utløse. Sendes i samme økt.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01JXFVEPTNkNqNgYWMLybtEC

ingest-spec.md

@@ -31,7 +31,8 @@ spec, the golden suite, or agent behaviour.
   connector) does not require any change to this spec, and NOT implementing it does not break
   conformance.
 - **Honesty rule (unwaivable, method spec §1):** a machine-generated bundle is labelled as
-  such (`generated: true` plus a manifest reference, §7) everywhere it is presented.
+  such (`generated.by` naming the ingest actor, plus a manifest reference, §7) everywhere it is
+  presented.
 - **Boundary:** the deploying organisation owns processing purposes and impact assessments;
   ingest provides only the technical prerequisites (local-only default, provenance, no silent
   egress).
@@ -67,9 +68,10 @@ approved knowledge into. Two rules keep ingest and the learning loop apart:
   self-contamination the gate exists to prevent. This MUST be enforced fail-fast at manifest
   validation (before any source call) and proven by a load-bearing test (§11).
 - **Ingest owns only its own files.** Re-materialization replaces EXACTLY the files carrying
-  the ingest stamp (`generated: true` plus an `ingest_manifest` reference, §7) and MUST NOT
+  the ingest stamp (`generated.by` equal to the ingest actor plus an `ingest_manifest`
-  touch curated or promoted files. If a generated filename collides with an existing file that
+  reference, §7) and MUST NOT touch curated or promoted files. If a generated filename
-  does NOT carry the stamp, materialization MUST fail — never overwrite curated content.
+  collides with an existing file that does NOT carry the stamp, materialization MUST fail —
+  never overwrite curated content.
   Index updating is idempotent and preserves curated links (§6). The stamp is unforgeable
   against **accident**, not against **will**: an operator who hand-copies a generated file —
   stamp and all — into curated content makes it indistinguishable from ingest-owned content,
@@ -79,10 +81,11 @@ approved knowledge into. Two rules keep ingest and the learning loop apart:
 - **No other writer may forge the stamp.** The stamp is the sole mark distinguishing
   ingest-owned files from curated ones, so any authoring primitive that materializes a concept
   file from **caller-supplied** frontmatter MUST reject a frontmatter carrying the *complete*
-  ownership stamp — `generated: true` together with an `ingest_manifest` reference — while
+  ownership stamp — `generated.by` equal to the ingest actor together with an `ingest_manifest`
-  permitting either field alone (curated content may legitimately carry a single provenance
+  reference — while permitting either field alone (curated content may legitimately carry a
-  field). The check is on the complete stamp, never on the individual field names, so a
+  single provenance field). The check is on the complete stamp, never on the individual field
-  legitimate verbatim round-trip is preserved; it is a **validation, never a repair**.
+  names, so a legitimate verbatim round-trip is preserved; it is a **validation, never a
+  repair**.
 
 ## 4. The ingest manifest (the contract)
 
@@ -211,7 +214,7 @@ that are never mixed — the same discipline as the two falsifiers.
 | `source_query` | The query that fetched the content (whitespace-collapsed, §5). |
 | `ingested_at` | The explicit timestamp argument, verbatim (§5). |
 | `ingest_manifest` | The manifest reference `{stem}@{hash16}` (§5). |
-| `generated` | Literally `true` — the machine-generated marker (§1 honesty rule). |
+| `generated` | The inline mapping `{ by: process:okf-ingest, at: <ingested_at> }`. `by` is the fixed ingest actor this spec defines — a `process:` actor, never a producer's name (§1 framework-neutrality); it is what marks the file machine-generated (§1 honesty rule), since the key's mere presence does not (curated content may carry a `human:` actor). `at` repeats the `ingested_at` value verbatim. Quoting is NOT normative: frontmatter is parsed line-oriented (method spec §3), so a quote character would be part of the value. |
 
 - OKF consumers preserve unknown frontmatter fields, so this layer rides through navigation
   and context rendering unchanged.
@@ -272,7 +275,7 @@ spec §11 regime):
 | Seam | The test MUST fail when… |
 |---|---|
 | Provenance stamping | a generated file no longer carries the §7 layer |
-| Stamp integrity (curated writers) | a caller-supplied frontmatter carrying the complete ownership stamp (`generated: true` with `ingest_manifest`) stops being rejected by the verbatim authoring path (§3) |
+| Stamp integrity (curated writers) | a caller-supplied frontmatter carrying the complete ownership stamp (`generated.by` equal to the ingest actor, with `ingest_manifest`) stops being rejected by the verbatim authoring path (§3) |
 | Navigability | the generated bundle stops being consumable by the UNCHANGED bundle-navigation code, index links included |
 | Verdict reservation | a manifest mapping to `type: verdict` (or the reserved filename namespace) stops being rejected |
 | Title link-safety | a `title` containing `[` or `]` stops being rejected fail-fast at manifest load (§4) |